/mandos/trunk : revision 518.2.3

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

64

68

65

69

import dbus

66

70

import dbus.service

71

75

import ctypes.util

72

76

import xml.dom.minidom

73

77

import inspect

78

import GnuPGInterface

74

79

75

80

try:

76

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

81

86

SO_BINDTODEVICE = None

82

87

83

88

84

version = "1.0.14"

89

version = "1.4.1"

90

stored_state_file = "clients.pickle"

85

91

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

92

logger = logging.getLogger()

88

93

syslogger = (logging.handlers.SysLogHandler

89

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

91

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

logger.addHandler(syslogger)

95

96

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

100

logger.addHandler(console)

95

address = str("/dev/log")))

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class CryptoError(Exception):

132

pass

133

134

135

class Crypto(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise CryptoError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise CryptoError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

208

101

209

102

210

class AvahiError(Exception):

103

211

def __init__(self, value, *args, **kwargs):

119

227

Attributes:

120

228

interface: integer; avahi.IF_UNSPEC or an interface index.

121

229

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

230

231

type: string; Example: '_mandos._tcp'.

124

232

See <http://www.dns-sd.org/ServiceTypes.html>

125

233

port: integer; what port to announce

126

234

TXT: list of strings; TXT record for the service

135

243

"""

136

244

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

245

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

246

domain = "", host = "", max_renames = 32768,

139

247

protocol = avahi.PROTO_UNSPEC, bus = None):

140

248

self.interface = interface

141

249

self.name = name

150

258

self.group = None # our entry group

151

259

self.server = None

152

260

self.bus = bus

261

self.entry_group_state_changed_match = None

153

262

def rename(self):

154

263

"""Derived from the Avahi example code"""

155

264

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

265

logger.critical("No suitable Zeroconf service name found"

266

" after %i retries, exiting.",

158

267

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

268

raise AvahiServiceError("Too many renames")

269

self.name = unicode(self.server

270

.GetAlternativeServiceName(self.name))

271

logger.info("Changing Zeroconf service name to %r ...",

162

272

self.name)

163

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

166

% self.name))

167

273

self.remove()

168

self.add()

274

try:

275

self.add()

276

except dbus.exceptions.DBusException as error:

277

logger.critical("DBusException: %s", error)

278

self.cleanup()

279

os._exit(1)

169

280

self.rename_count += 1

170

281

def remove(self):

171

282

"""Derived from the Avahi example code"""

283

if self.entry_group_state_changed_match is not None:

284

self.entry_group_state_changed_match.remove()

285

self.entry_group_state_changed_match = None

172

286

if self.group is not None:

173

287

self.group.Reset()

174

288

def add(self):

175

289

"""Derived from the Avahi example code"""

290

self.remove()

176

291

if self.group is None:

177

292

self.group = dbus.Interface(

178

293

self.bus.get_object(avahi.DBUS_NAME,

179

294

self.server.EntryGroupNew()),

180

295

avahi.DBUS_INTERFACE_ENTRY_GROUP)

181

self.group.connect_to_signal('StateChanged',

182

self

183

.entry_group_state_changed)

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

296

self.entry_group_state_changed_match = (

297

self.group.connect_to_signal(

298

'StateChanged', self.entry_group_state_changed))

299

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

185

300

self.name, self.type)

186

301

self.group.AddService(

187

302

self.interface,

194

309

self.group.Commit()

195

310

def entry_group_state_changed(self, state, error):

196

311

"""Derived from the Avahi example code"""

197

logger.debug(u"Avahi state change: %i", state)

312

logger.debug("Avahi entry group state change: %i", state)

198

313

199

314

if state == avahi.ENTRY_GROUP_ESTABLISHED:

200

logger.debug(u"Zeroconf service established.")

315

logger.debug("Zeroconf service established.")

201

316

elif state == avahi.ENTRY_GROUP_COLLISION:

202

logger.warning(u"Zeroconf service name collision.")

317

logger.info("Zeroconf service name collision.")

203

318

self.rename()

204

319

elif state == avahi.ENTRY_GROUP_FAILURE:

205

logger.critical(u"Avahi: Error in group state changed %s",

320

logger.critical("Avahi: Error in group state changed %s",

206

321

unicode(error))

207

raise AvahiGroupError(u"State changed: %s"

322

raise AvahiGroupError("State changed: %s"

208

323

% unicode(error))

209

324

def cleanup(self):

210

325

"""Derived from the Avahi example code"""

211

326

if self.group is not None:

212

self.group.Free()

327

try:

328

self.group.Free()

329

except (dbus.exceptions.UnknownMethodException,

330

dbus.exceptions.DBusException):

331

pass

213

332

self.group = None

214

def server_state_changed(self, state):

333

self.remove()

334

def server_state_changed(self, state, error=None):

215

335

"""Derived from the Avahi example code"""

216

if state == avahi.SERVER_COLLISION:

217

logger.error(u"Zeroconf server name collision")

218

self.remove()

336

logger.debug("Avahi server state change: %i", state)

337

bad_states = { avahi.SERVER_INVALID:

338

"Zeroconf server invalid",

339

avahi.SERVER_REGISTERING: None,

340

avahi.SERVER_COLLISION:

341

"Zeroconf server name collision",

342

avahi.SERVER_FAILURE:

343

"Zeroconf server failure" }

344

if state in bad_states:

345

if bad_states[state] is not None:

346

if error is None:

347

logger.error(bad_states[state])

348

else:

349

logger.error(bad_states[state] + ": %r", error)

350

self.cleanup()

219

351

elif state == avahi.SERVER_RUNNING:

220

352

self.add()

353

else:

354

if error is None:

355

logger.debug("Unknown state: %r", state)

356

else:

357

logger.debug("Unknown state: %r: %r", state, error)

221

358

def activate(self):

222

359

"""Derived from the Avahi example code"""

223

360

if self.server is None:

224

361

self.server = dbus.Interface(

225

362

self.bus.get_object(avahi.DBUS_NAME,

226

avahi.DBUS_PATH_SERVER),

363

avahi.DBUS_PATH_SERVER,

364

follow_name_owner_changes=True),

227

365

avahi.DBUS_INTERFACE_SERVER)

228

self.server.connect_to_signal(u"StateChanged",

366

self.server.connect_to_signal("StateChanged",

229

367

self.server_state_changed)

230

368

self.server_state_changed(self.server.GetState())

231

369

370

class AvahiServiceToSyslog(AvahiService):

371

def rename(self):

372

"""Add the new name to the syslog messages"""

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

378

return ret

232

379

380

def _timedelta_to_milliseconds(td):

381

"Convert a datetime.timedelta() to milliseconds"

382

return ((td.days * 24 * 60 * 60 * 1000)

383

+ (td.seconds * 1000)

384

+ (td.microseconds // 1000))

385

233

386

class Client(object):

234

387

"""A representation of a client host served by this server.

235

388

236

389

Attributes:

237

238

D-Bus identifiers

390

_approved: bool(); 'None' if not yet approved/disapproved

391

approval_delay: datetime.timedelta(); Time to wait for approval

392

approval_duration: datetime.timedelta(); Duration of one approval

393

checker: subprocess.Popen(); a running checker process used

394

to see if the client lives.

395

'None' if no process is running.

396

checker_callback_tag: a gobject event source tag, or None

397

checker_command: string; External command which is run to check

398

if client lives. %() expansions are done at

399

runtime with vars(self) as dict, so that for

400

instance %(name)s can be used in the command.

401

checker_initiator_tag: a gobject event source tag, or None

402

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

405

current_checker_command: string; current running checker_command

406

disable_initiator_tag: a gobject event source tag, or None

407

enabled: bool()

239

408

fingerprint: string (40 or 32 hexadecimal digits); used to

240

409

uniquely identify the client

241

secret: bytestring; sent verbatim (over TLS) to client

242

410

host: string; available for use by the checker command

243

created: datetime.datetime(); (UTC) object creation

244

last_enabled: datetime.datetime(); (UTC)

245

enabled: bool()

411

interval: datetime.timedelta(); How often to start a new checker

412

last_approval_request: datetime.datetime(); (UTC) or None

246

413

last_checked_ok: datetime.datetime(); (UTC) or None

414

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

419

420

D-Bus identifiers

421

secret: bytestring; sent verbatim (over TLS) to client

247

422

timeout: datetime.timedelta(); How long from last_checked_ok

248

423

until this client is disabled

249

interval: datetime.timedelta(); How often to start a new checker

250

disable_hook: If set, called by disable() as disable_hook(self)

251

checker: subprocess.Popen(); a running checker process used

252

to see if the client lives.

253

'None' if no process is running.

254

checker_initiator_tag: a gobject event source tag, or None

255

disable_initiator_tag: - '' -

256

checker_callback_tag: - '' -

257

checker_command: string; External command which is run to check if

258

client lives. %() expansions are done at

259

runtime with vars(self) as dict, so that for

260

instance %(name)s can be used in the command.

261

current_checker_command: string; current running checker_command

262

approved_delay: datetime.timedelta(); Time to wait for approval

263

_approved: bool(); 'None' if not yet approved/disapproved

264

approved_duration: datetime.timedelta(); Duration of one approval

424

extended_timeout: extra long timeout when password has been sent

425

runtime_expansions: Allowed attributes for runtime expansion.

426

expires: datetime.datetime(); time (UTC) when a client will be

427

disabled, or None

265

428

"""

266

429

267

@staticmethod

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

430

runtime_expansions = ("approval_delay", "approval_duration",

431

"created", "enabled", "fingerprint",

432

"host", "interval", "last_checked_ok",

433

"last_enabled", "name", "timeout")

273

434

274

435

def timeout_milliseconds(self):

275

436

"Return the 'timeout' attribute in milliseconds"

276

return self._timedelta_to_milliseconds(self.timeout)

437

return _timedelta_to_milliseconds(self.timeout)

438

439

def extended_timeout_milliseconds(self):

440

"Return the 'extended_timeout' attribute in milliseconds"

441

return _timedelta_to_milliseconds(self.extended_timeout)

277

442

278

443

def interval_milliseconds(self):

279

444

"Return the 'interval' attribute in milliseconds"

280

return self._timedelta_to_milliseconds(self.interval)

281

282

def approved_delay_milliseconds(self):

283

return self._timedelta_to_milliseconds(self.approved_delay)

284

285

def __init__(self, name = None, disable_hook=None, config=None):

445

return _timedelta_to_milliseconds(self.interval)

446

447

def approval_delay_milliseconds(self):

448

return _timedelta_to_milliseconds(self.approval_delay)

449

450

def __init__(self, name = None, config=None):

286

451

"""Note: the 'checker' key in 'config' sets the

287

452

'checker_command' attribute and *not* the 'checker'

288

453

attribute."""

289

454

self.name = name

290

455

if config is None:

291

456

config = {}

292

logger.debug(u"Creating client %r", self.name)

457

logger.debug("Creating client %r", self.name)

293

458

# Uppercase and remove spaces from fingerprint for later

294

459

# comparison purposes with return value from the fingerprint()

295

460

# function

296

self.fingerprint = (config[u"fingerprint"].upper()

297

.replace(u" ", u""))

298

logger.debug(u" Fingerprint: %s", self.fingerprint)

299

if u"secret" in config:

300

self.secret = config[u"secret"].decode(u"base64")

301

elif u"secfile" in config:

461

self.fingerprint = (config["fingerprint"].upper()

462

.replace(" ", ""))

463

logger.debug(" Fingerprint: %s", self.fingerprint)

464

if "secret" in config:

465

self.secret = config["secret"].decode("base64")

466

elif "secfile" in config:

302

467

with open(os.path.expanduser(os.path.expandvars

303

(config[u"secfile"])),

468

(config["secfile"])),

304

469

"rb") as secfile:

305

470

self.secret = secfile.read()

306

471

else:

307

raise TypeError(u"No secret or secfile for client %s"

472

raise TypeError("No secret or secfile for client %s"

308

473

% self.name)

309

self.host = config.get(u"host", u"")

474

self.host = config.get("host", "")

310

475

self.created = datetime.datetime.utcnow()

311

self.enabled = False

312

self.last_enabled = None

476

self.enabled = config.get("enabled", True)

477

self.last_approval_request = None

478

if self.enabled:

479

self.last_enabled = datetime.datetime.utcnow()

480

else:

481

self.last_enabled = None

313

482

self.last_checked_ok = None

314

self.timeout = string_to_delta(config[u"timeout"])

315

self.interval = string_to_delta(config[u"interval"])

316

self.disable_hook = disable_hook

483

self.last_checker_status = None

484

self.timeout = string_to_delta(config["timeout"])

485

self.extended_timeout = string_to_delta(config

486

["extended_timeout"])

487

self.interval = string_to_delta(config["interval"])

317

488

self.checker = None

318

489

self.checker_initiator_tag = None

319

490

self.disable_initiator_tag = None

491

if self.enabled:

492

self.expires = datetime.datetime.utcnow() + self.timeout

493

else:

494

self.expires = None

320

495

self.checker_callback_tag = None

321

self.checker_command = config[u"checker"]

496

self.checker_command = config["checker"]

322

497

self.current_checker_command = None

323

self.last_connect = None

324

498

self._approved = None

325

self.approved_by_default = config.get(u"approved_by_default",

499

self.approved_by_default = config.get("approved_by_default",

326

500

True)

327

501

self.approvals_pending = 0

328

self.approved_delay = string_to_delta(

329

config[u"approved_delay"])

330

self.approved_duration = string_to_delta(

331

config[u"approved_duration"])

332

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

502

self.approval_delay = string_to_delta(

503

config["approval_delay"])

504

self.approval_duration = string_to_delta(

505

config["approval_duration"])

506

self.changedstate = (multiprocessing_manager

507

.Condition(multiprocessing_manager

508

.Lock()))

509

self.client_structure = [attr for attr in

510

self.__dict__.iterkeys()

511

if not attr.startswith("_")]

512

self.client_structure.append("client_structure")

513

514

for name, t in inspect.getmembers(type(self),

515

lambda obj:

516

isinstance(obj,

517

property)):

518

if not name.startswith("_"):

519

self.client_structure.append(name)

333

520

521

# Send notice to process children that client state has changed

334

522

def send_changedstate(self):

335

self.changedstate.acquire()

336

self.changedstate.notify_all()

337

self.changedstate.release()

338

523

with self.changedstate:

524

self.changedstate.notify_all()

525

339

526

def enable(self):

340

527

"""Start this client's checker and timeout hooks"""

341

if getattr(self, u"enabled", False):

528

if getattr(self, "enabled", False):

342

529

# Already enabled

343

530

return

344

531

self.send_changedstate()

532

self.expires = datetime.datetime.utcnow() + self.timeout

533

self.enabled = True

345

534

self.last_enabled = datetime.datetime.utcnow()

535

self.init_checker()

536

537

def disable(self, quiet=True):

538

"""Disable this client."""

539

if not getattr(self, "enabled", False):

540

return False

541

if not quiet:

542

self.send_changedstate()

543

if not quiet:

544

logger.info("Disabling client %s", self.name)

545

if getattr(self, "disable_initiator_tag", False):

546

gobject.source_remove(self.disable_initiator_tag)

547

self.disable_initiator_tag = None

548

self.expires = None

549

if getattr(self, "checker_initiator_tag", False):

550

gobject.source_remove(self.checker_initiator_tag)

551

self.checker_initiator_tag = None

552

self.stop_checker()

553

self.enabled = False

554

# Do not run this again if called by a gobject.timeout_add

555

return False

556

557

def __del__(self):

558

self.disable()

559

560

def init_checker(self):

346

561

# Schedule a new checker to be started an 'interval' from now,

347

562

# and every interval from then on.

348

563

self.checker_initiator_tag = (gobject.timeout_add

352

567

self.disable_initiator_tag = (gobject.timeout_add

353

568

(self.timeout_milliseconds(),

354

569

self.disable))

355

self.enabled = True

356

570

# Also start a new checker *right now*.

357

571

self.start_checker()

358

572

359

def disable(self, quiet=True):

360

"""Disable this client."""

361

if not getattr(self, "enabled", False):

362

return False

363

if not quiet:

364

self.send_changedstate()

365

if not quiet:

366

logger.info(u"Disabling client %s", self.name)

367

if getattr(self, u"disable_initiator_tag", False):

368

gobject.source_remove(self.disable_initiator_tag)

369

self.disable_initiator_tag = None

370

if getattr(self, u"checker_initiator_tag", False):

371

gobject.source_remove(self.checker_initiator_tag)

372

self.checker_initiator_tag = None

373

self.stop_checker()

374

if self.disable_hook:

375

self.disable_hook(self)

376

self.enabled = False

377

# Do not run this again if called by a gobject.timeout_add

378

return False

379

380

def __del__(self):

381

self.disable_hook = None

382

self.disable()

383

384

573

def checker_callback(self, pid, condition, command):

385

574

"""The checker has completed, so take appropriate actions."""

386

575

self.checker_callback_tag = None

387

576

self.checker = None

388

577

if os.WIFEXITED(condition):

389

exitstatus = os.WEXITSTATUS(condition)

390

if exitstatus == 0:

391

logger.info(u"Checker for %(name)s succeeded",

578

self.last_checker_status = os.WEXITSTATUS(condition)

579

if self.last_checker_status == 0:

580

logger.info("Checker for %(name)s succeeded",

392

581

vars(self))

393

582

self.checked_ok()

394

583

else:

395

logger.info(u"Checker for %(name)s failed",

584

logger.info("Checker for %(name)s failed",

396

585

vars(self))

397

586

else:

398

logger.warning(u"Checker for %(name)s crashed?",

587

self.last_checker_status = -1

588

logger.warning("Checker for %(name)s crashed?",

399

589

vars(self))

400

590

401

def checked_ok(self):

591

def checked_ok(self, timeout=None):

402

592

"""Bump up the timeout for this client.

403

593

404

594

This should only be called when the client has been seen,

405

595

alive and well.

406

596

"""

597

if timeout is None:

598

timeout = self.timeout

407

599

self.last_checked_ok = datetime.datetime.utcnow()

408

gobject.source_remove(self.disable_initiator_tag)

409

self.disable_initiator_tag = (gobject.timeout_add

410

(self.timeout_milliseconds(),

411

self.disable))

600

if self.disable_initiator_tag is not None:

601

gobject.source_remove(self.disable_initiator_tag)

602

if getattr(self, "enabled", False):

603

self.disable_initiator_tag = (gobject.timeout_add

604

(_timedelta_to_milliseconds

605

(timeout), self.disable))

606

self.expires = datetime.datetime.utcnow() + timeout

607

608

def need_approval(self):

609

self.last_approval_request = datetime.datetime.utcnow()

412

610

413

611

def start_checker(self):

414

612

"""Start a new checker subprocess if one is not running.

427

625

# If a checker exists, make sure it is not a zombie

428

626

try:

429

627

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

430

except (AttributeError, OSError), error:

628

except (AttributeError, OSError) as error:

431

629

if (isinstance(error, OSError)

432

630

and error.errno != errno.ECHILD):

433

631

raise error

434

632

else:

435

633

if pid:

436

logger.warning(u"Checker was a zombie")

634

logger.warning("Checker was a zombie")

437

635

gobject.source_remove(self.checker_callback_tag)

438

636

self.checker_callback(pid, status,

439

637

self.current_checker_command)

444

642

command = self.checker_command % self.host

445

643

except TypeError:

446

644

# Escape attributes for the shell

447

escaped_attrs = dict((key,

448

re.escape(unicode(str(val),

449

errors=

450

u'replace')))

451

for key, val in

452

vars(self).iteritems())

645

escaped_attrs = dict(

646

(attr,

647

re.escape(unicode(str(getattr(self, attr, "")),

648

errors=

649

'replace')))

650

for attr in

651

self.runtime_expansions)

652

453

653

try:

454

654

command = self.checker_command % escaped_attrs

455

except TypeError, error:

456

logger.error(u'Could not format string "%s":'

457

u' %s', self.checker_command, error)

655

except TypeError as error:

656

logger.error('Could not format string "%s":'

657

' %s', self.checker_command, error)

458

658

return True # Try again later

459

659

self.current_checker_command = command

460

660

try:

461

logger.info(u"Starting checker %r for %s",

661

logger.info("Starting checker %r for %s",

462

662

command, self.name)

463

663

# We don't need to redirect stdout and stderr, since

464

664

# in normal mode, that is already done by daemon(),

466

666

# always replaced by /dev/null.)

467

667

self.checker = subprocess.Popen(command,

468

668

close_fds=True,

469

shell=True, cwd=u"/")

669

shell=True, cwd="/")

470

670

self.checker_callback_tag = (gobject.child_watch_add

471

671

(self.checker.pid,

472

672

self.checker_callback,

477

677

if pid:

478

678

gobject.source_remove(self.checker_callback_tag)

479

679

self.checker_callback(pid, status, command)

480

except OSError, error:

481

logger.error(u"Failed to start subprocess: %s",

680

except OSError as error:

681

logger.error("Failed to start subprocess: %s",

482

682

error)

483

683

# Re-run this periodically if run by gobject.timeout_add

484

684

return True

488

688

if self.checker_callback_tag:

489

689

gobject.source_remove(self.checker_callback_tag)

490

690

self.checker_callback_tag = None

491

if getattr(self, u"checker", None) is None:

691

if getattr(self, "checker", None) is None:

492

692

return

493

logger.debug(u"Stopping checker for %(name)s", vars(self))

693

logger.debug("Stopping checker for %(name)s", vars(self))

494

694

try:

495

695

os.kill(self.checker.pid, signal.SIGTERM)

496

696

#time.sleep(0.5)

497

697

#if self.checker.poll() is None:

498

698

# os.kill(self.checker.pid, signal.SIGKILL)

499

except OSError, error:

699

except OSError as error:

500

700

if error.errno != errno.ESRCH: # No such process

501

701

raise

502

702

self.checker = None

503

703

504

def dbus_service_property(dbus_interface, signature=u"v",

505

access=u"readwrite", byte_arrays=False):

704

705

def dbus_service_property(dbus_interface, signature="v",

706

access="readwrite", byte_arrays=False):

506

707

"""Decorators for marking methods of a DBusObjectWithProperties to

507

708

become properties on the D-Bus.

508

709

515

716

"""

516

717

# Encoding deeply encoded byte arrays is not supported yet by the

517

718

# "Set" method, so we fail early here:

518

if byte_arrays and signature != u"ay":

519

raise ValueError(u"Byte arrays not supported for non-'ay'"

520

u" signature %r" % signature)

719

if byte_arrays and signature != "ay":

720

raise ValueError("Byte arrays not supported for non-'ay'"

721

" signature %r" % signature)

521

722

def decorator(func):

522

723

func._dbus_is_property = True

523

724

func._dbus_interface = dbus_interface

524

725

func._dbus_signature = signature

525

726

func._dbus_access = access

526

727

func._dbus_name = func.__name__

527

if func._dbus_name.endswith(u"_dbus_property"):

728

if func._dbus_name.endswith("_dbus_property"):

528

729

func._dbus_name = func._dbus_name[:-14]

529

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

730

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

530

731

return func

531

732

return decorator

532

733

552

753

553

754

class DBusObjectWithProperties(dbus.service.Object):

554

755

"""A D-Bus object with properties.

555

756

556

757

Classes inheriting from this can use the dbus_service_property

557

758

decorator to expose methods as D-Bus properties. It exposes the

558

759

standard Get(), Set(), and GetAll() methods on the D-Bus.

560

761

561

762

@staticmethod

562

763

def _is_dbus_property(obj):

563

return getattr(obj, u"_dbus_is_property", False)

764

return getattr(obj, "_dbus_is_property", False)

564

765

565

766

def _get_all_dbus_properties(self):

566

767

"""Returns a generator of (name, attribute) pairs

567

768

"""

568

return ((prop._dbus_name, prop)

769

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

770

for cls in self.__class__.__mro__

569

771

for name, prop in

570

inspect.getmembers(self, self._is_dbus_property))

772

inspect.getmembers(cls, self._is_dbus_property))

571

773

572

774

def _get_dbus_property(self, interface_name, property_name):

573

775

"""Returns a bound method if one exists which is a D-Bus

574

776

property with the specified name and interface.

575

777

"""

576

for name in (property_name,

577

property_name + u"_dbus_property"):

578

prop = getattr(self, name, None)

579

if (prop is None

580

or not self._is_dbus_property(prop)

581

or prop._dbus_name != property_name

582

or (interface_name and prop._dbus_interface

583

and interface_name != prop._dbus_interface)):

584

continue

585

return prop

778

for cls in self.__class__.__mro__:

779

for name, value in (inspect.getmembers

780

(cls, self._is_dbus_property)):

781

if (value._dbus_name == property_name

782

and value._dbus_interface == interface_name):

783

return value.__get__(self)

784

586

785

# No such property

587

raise DBusPropertyNotFound(self.dbus_object_path + u":"

588

+ interface_name + u"."

786

raise DBusPropertyNotFound(self.dbus_object_path + ":"

787

+ interface_name + "."

589

788

+ property_name)

590

789

591

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

592

out_signature=u"v")

790

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

791

out_signature="v")

593

792

def Get(self, interface_name, property_name):

594

793

"""Standard D-Bus property Get() method, see D-Bus standard.

595

794

"""

596

795

prop = self._get_dbus_property(interface_name, property_name)

597

if prop._dbus_access == u"write":

796

if prop._dbus_access == "write":

598

797

raise DBusPropertyAccessException(property_name)

599

798

value = prop()

600

if not hasattr(value, u"variant_level"):

799

if not hasattr(value, "variant_level"):

601

800

return value

602

801

return type(value)(value, variant_level=value.variant_level+1)

603

802

604

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

803

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

605

804

def Set(self, interface_name, property_name, value):

606

805

"""Standard D-Bus property Set() method, see D-Bus standard.

607

806

"""

608

807

prop = self._get_dbus_property(interface_name, property_name)

609

if prop._dbus_access == u"read":

808

if prop._dbus_access == "read":

610

809

raise DBusPropertyAccessException(property_name)

611

if prop._dbus_get_args_options[u"byte_arrays"]:

810

if prop._dbus_get_args_options["byte_arrays"]:

612

811

# The byte_arrays option is not supported yet on

613

812

# signatures other than "ay".

614

if prop._dbus_signature != u"ay":

813

if prop._dbus_signature != "ay":

615

814

raise ValueError

616

815

value = dbus.ByteArray(''.join(unichr(byte)

617

816

for byte in value))

618

817

prop(value)

619

818

620

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

621

out_signature=u"a{sv}")

819

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

820

out_signature="a{sv}")

622

821

def GetAll(self, interface_name):

623

822

"""Standard D-Bus property GetAll() method, see D-Bus

624

823

standard.

625

824

626

825

Note: Will not include properties with access="write".

627

826

"""

628

all = {}

827

properties = {}

629

828

for name, prop in self._get_all_dbus_properties():

630

829

if (interface_name

631

830

and interface_name != prop._dbus_interface):

632

831

# Interface non-empty but did not match

633

832

continue

634

833

# Ignore write-only properties

635

if prop._dbus_access == u"write":

834

if prop._dbus_access == "write":

636

835

continue

637

836

value = prop()

638

if not hasattr(value, u"variant_level"):

639

all[name] = value

837

if not hasattr(value, "variant_level"):

838

properties[name] = value

640

839

continue

641

all[name] = type(value)(value, variant_level=

642

value.variant_level+1)

643

return dbus.Dictionary(all, signature=u"sv")

840

properties[name] = type(value)(value, variant_level=

841

value.variant_level+1)

842

return dbus.Dictionary(properties, signature="sv")

644

843

645

844

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

646

out_signature=u"s",

845

out_signature="s",

647

846

path_keyword='object_path',

648

847

connection_keyword='connection')

649

848

def Introspect(self, object_path, connection):

654

853

try:

655

854

document = xml.dom.minidom.parseString(xmlstring)

656

855

def make_tag(document, name, prop):

657

e = document.createElement(u"property")

658

e.setAttribute(u"name", name)

659

e.setAttribute(u"type", prop._dbus_signature)

660

e.setAttribute(u"access", prop._dbus_access)

856

e = document.createElement("property")

857

e.setAttribute("name", name)

858

e.setAttribute("type", prop._dbus_signature)

859

e.setAttribute("access", prop._dbus_access)

661

860

return e

662

for if_tag in document.getElementsByTagName(u"interface"):

861

for if_tag in document.getElementsByTagName("interface"):

663

862

for tag in (make_tag(document, name, prop)

664

863

for name, prop

665

864

in self._get_all_dbus_properties()

666

865

if prop._dbus_interface

667

== if_tag.getAttribute(u"name")):

866

== if_tag.getAttribute("name")):

668

867

if_tag.appendChild(tag)

669

868

# Add the names to the return values for the

670

869

# "org.freedesktop.DBus.Properties" methods

671

if (if_tag.getAttribute(u"name")

672

== u"org.freedesktop.DBus.Properties"):

673

for cn in if_tag.getElementsByTagName(u"method"):

674

if cn.getAttribute(u"name") == u"Get":

675

for arg in cn.getElementsByTagName(u"arg"):

676

if (arg.getAttribute(u"direction")

677

== u"out"):

678

arg.setAttribute(u"name", u"value")

679

elif cn.getAttribute(u"name") == u"GetAll":

680

for arg in cn.getElementsByTagName(u"arg"):

681

if (arg.getAttribute(u"direction")

682

== u"out"):

683

arg.setAttribute(u"name", u"props")

684

xmlstring = document.toxml(u"utf-8")

870

if (if_tag.getAttribute("name")

871

== "org.freedesktop.DBus.Properties"):

872

for cn in if_tag.getElementsByTagName("method"):

873

if cn.getAttribute("name") == "Get":

874

for arg in cn.getElementsByTagName("arg"):

875

if (arg.getAttribute("direction")

876

== "out"):

877

arg.setAttribute("name", "value")

878

elif cn.getAttribute("name") == "GetAll":

879

for arg in cn.getElementsByTagName("arg"):

880

if (arg.getAttribute("direction")

881

== "out"):

882

arg.setAttribute("name", "props")

883

xmlstring = document.toxml("utf-8")

685

884

document.unlink()

686

885

except (AttributeError, xml.dom.DOMException,

687

xml.parsers.expat.ExpatError), error:

688

logger.error(u"Failed to override Introspection method",

886

xml.parsers.expat.ExpatError) as error:

887

logger.error("Failed to override Introspection method",

689

888

error)

690

889

return xmlstring

691

890

692

891

892

def datetime_to_dbus (dt, variant_level=0):

893

"""Convert a UTC datetime.datetime() to a D-Bus type."""

894

if dt is None:

895

return dbus.String("", variant_level = variant_level)

896

return dbus.String(dt.isoformat(),

897

variant_level=variant_level)

898

899

900

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

901

.__metaclass__):

902

"""Applied to an empty subclass of a D-Bus object, this metaclass

903

will add additional D-Bus attributes matching a certain pattern.

904

"""

905

def __new__(mcs, name, bases, attr):

906

# Go through all the base classes which could have D-Bus

907

# methods, signals, or properties in them

908

for base in (b for b in bases

909

if issubclass(b, dbus.service.Object)):

910

# Go though all attributes of the base class

911

for attrname, attribute in inspect.getmembers(base):

912

# Ignore non-D-Bus attributes, and D-Bus attributes

913

# with the wrong interface name

914

if (not hasattr(attribute, "_dbus_interface")

915

or not attribute._dbus_interface

916

.startswith("se.recompile.Mandos")):

917

continue

918

# Create an alternate D-Bus interface name based on

919

# the current name

920

alt_interface = (attribute._dbus_interface

921

.replace("se.recompile.Mandos",

922

"se.bsnet.fukt.Mandos"))

923

# Is this a D-Bus signal?

924

if getattr(attribute, "_dbus_is_signal", False):

925

# Extract the original non-method function by

926

# black magic

927

nonmethod_func = (dict(

928

zip(attribute.func_code.co_freevars,

929

attribute.__closure__))["func"]

930

.cell_contents)

931

# Create a new, but exactly alike, function

932

# object, and decorate it to be a new D-Bus signal

933

# with the alternate D-Bus interface name

934

new_function = (dbus.service.signal

935

(alt_interface,

936

attribute._dbus_signature)

937

(types.FunctionType(

938

nonmethod_func.func_code,

939

nonmethod_func.func_globals,

940

nonmethod_func.func_name,

941

nonmethod_func.func_defaults,

942

nonmethod_func.func_closure)))

943

# Define a creator of a function to call both the

944

# old and new functions, so both the old and new

945

# signals gets sent when the function is called

946

def fixscope(func1, func2):

947

"""This function is a scope container to pass

948

func1 and func2 to the "call_both" function

949

outside of its arguments"""

950

def call_both(*args, **kwargs):

951

"""This function will emit two D-Bus

952

signals by calling func1 and func2"""

953

func1(*args, **kwargs)

954

func2(*args, **kwargs)

955

return call_both

956

# Create the "call_both" function and add it to

957

# the class

958

attr[attrname] = fixscope(attribute,

959

new_function)

960

# Is this a D-Bus method?

961

elif getattr(attribute, "_dbus_is_method", False):

962

# Create a new, but exactly alike, function

963

# object. Decorate it to be a new D-Bus method

964

# with the alternate D-Bus interface name. Add it

965

# to the class.

966

attr[attrname] = (dbus.service.method

967

(alt_interface,

968

attribute._dbus_in_signature,

969

attribute._dbus_out_signature)

970

(types.FunctionType

971

(attribute.func_code,

972

attribute.func_globals,

973

attribute.func_name,

974

attribute.func_defaults,

975

attribute.func_closure)))

976

# Is this a D-Bus property?

977

elif getattr(attribute, "_dbus_is_property", False):

978

# Create a new, but exactly alike, function

979

# object, and decorate it to be a new D-Bus

980

# property with the alternate D-Bus interface

981

# name. Add it to the class.

982

attr[attrname] = (dbus_service_property

983

(alt_interface,

984

attribute._dbus_signature,

985

attribute._dbus_access,

986

attribute

987

._dbus_get_args_options

988

["byte_arrays"])

989

(types.FunctionType

990

(attribute.func_code,

991

attribute.func_globals,

992

attribute.func_name,

993

attribute.func_defaults,

994

attribute.func_closure)))

995

return type.__new__(mcs, name, bases, attr)

996

997

693

998

class ClientDBus(Client, DBusObjectWithProperties):

694

999

"""A Client class using D-Bus

695

1000

697

1002

dbus_object_path: dbus.ObjectPath

698

1003

bus: dbus.SystemBus()

699

1004

"""

1005

1006

runtime_expansions = (Client.runtime_expansions

1007

+ ("dbus_object_path",))

1008

700

1009

# dbus.service.Object doesn't use super(), so we can't either.

701

1010

702

1011

def __init__(self, bus = None, *args, **kwargs):

1012

self.bus = bus

1013

Client.__init__(self, *args, **kwargs)

1014

703

1015

self._approvals_pending = 0

704

self.bus = bus

705

Client.__init__(self, *args, **kwargs)

706

1016

# Only now, when this client is initialized, can it show up on

707

1017

# the D-Bus

1018

client_object_name = unicode(self.name).translate(

1019

{ord("."): ord("_"),

1020

ord("-"): ord("_")})

708

1021

self.dbus_object_path = (dbus.ObjectPath

709

(u"/clients/"

710

+ self.name.replace(u".", u"_")))

1022

("/clients/" + client_object_name))

711

1023

DBusObjectWithProperties.__init__(self, self.bus,

712

1024

self.dbus_object_path)

713

714

def _get_approvals_pending(self):

715

return self._approvals_pending

716

def _set_approvals_pending(self, value):

717

old_value = self._approvals_pending

718

self._approvals_pending = value

719

bval = bool(value)

720

if (hasattr(self, "dbus_object_path")

721

and bval is not bool(old_value)):

722

dbus_bool = dbus.Boolean(bval, variant_level=1)

723

self.PropertyChanged(dbus.String(u"approved_pending"),

724

dbus_bool)

725

726

approvals_pending = property(_get_approvals_pending,

727

_set_approvals_pending)

728

del _get_approvals_pending, _set_approvals_pending

729

730

@staticmethod

731

def _datetime_to_dbus(dt, variant_level=0):

732

"""Convert a UTC datetime.datetime() to a D-Bus type."""

733

return dbus.String(dt.isoformat(),

734

variant_level=variant_level)

735

736

def enable(self):

737

oldstate = getattr(self, u"enabled", False)

738

r = Client.enable(self)

739

if oldstate != self.enabled:

740

# Emit D-Bus signals

741

self.PropertyChanged(dbus.String(u"enabled"),

742

dbus.Boolean(True, variant_level=1))

743

self.PropertyChanged(

744

dbus.String(u"last_enabled"),

745

self._datetime_to_dbus(self.last_enabled,

746

variant_level=1))

747

return r

748

749

def disable(self, quiet = False):

750

oldstate = getattr(self, u"enabled", False)

751

r = Client.disable(self, quiet=quiet)

752

if not quiet and oldstate != self.enabled:

753

# Emit D-Bus signal

754

self.PropertyChanged(dbus.String(u"enabled"),

755

dbus.Boolean(False, variant_level=1))

756

return r

1025

1026

def notifychangeproperty(transform_func,

1027

dbus_name, type_func=lambda x: x,

1028

variant_level=1):

1029

""" Modify a variable so that it's a property which announces

1030

its changes to DBus.

1031

1032

transform_fun: Function that takes a value and a variant_level

1033

and transforms it to a D-Bus type.

1034

dbus_name: D-Bus name of the variable

1035

type_func: Function that transform the value before sending it

1036

to the D-Bus. Default: no transform

1037

variant_level: D-Bus variant level. Default: 1

1038

"""

1039

attrname = "_{0}".format(dbus_name)

1040

def setter(self, value):

1041

if hasattr(self, "dbus_object_path"):

1042

if (not hasattr(self, attrname) or

1043

type_func(getattr(self, attrname, None))

1044

!= type_func(value)):

1045

dbus_value = transform_func(type_func(value),

1046

variant_level

1047

=variant_level)

1048

self.PropertyChanged(dbus.String(dbus_name),

1049

dbus_value)

1050

setattr(self, attrname, value)

1051

1052

return property(lambda self: getattr(self, attrname), setter)

1053

1054

1055

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1056

approvals_pending = notifychangeproperty(dbus.Boolean,

1057

"ApprovalPending",

1058

type_func = bool)

1059

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1060

last_enabled = notifychangeproperty(datetime_to_dbus,

1061

"LastEnabled")

1062

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1063

type_func = lambda checker:

1064

checker is not None)

1065

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1066

"LastCheckedOK")

1067

last_approval_request = notifychangeproperty(

1068

datetime_to_dbus, "LastApprovalRequest")

1069

approved_by_default = notifychangeproperty(dbus.Boolean,

1070

"ApprovedByDefault")

1071

approval_delay = notifychangeproperty(dbus.UInt16,

1072

"ApprovalDelay",

1073

type_func =

1074

_timedelta_to_milliseconds)

1075

approval_duration = notifychangeproperty(

1076

dbus.UInt16, "ApprovalDuration",

1077

type_func = _timedelta_to_milliseconds)

1078

host = notifychangeproperty(dbus.String, "Host")

1079

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1080

type_func =

1081

_timedelta_to_milliseconds)

1082

extended_timeout = notifychangeproperty(

1083

dbus.UInt16, "ExtendedTimeout",

1084

type_func = _timedelta_to_milliseconds)

1085

interval = notifychangeproperty(dbus.UInt16,

1086

"Interval",

1087

type_func =

1088

_timedelta_to_milliseconds)

1089

checker_command = notifychangeproperty(dbus.String, "Checker")

1090

1091

del notifychangeproperty

757

1092

758

1093

def __del__(self, *args, **kwargs):

759

1094

try:

760

1095

self.remove_from_connection()

761

1096

except LookupError:

762

1097

pass

763

if hasattr(DBusObjectWithProperties, u"__del__"):

1098

if hasattr(DBusObjectWithProperties, "__del__"):

764

1099

DBusObjectWithProperties.__del__(self, *args, **kwargs)

765

1100

Client.__del__(self, *args, **kwargs)

766

1101

768

1103

*args, **kwargs):

769

1104

self.checker_callback_tag = None

770

1105

self.checker = None

771

# Emit D-Bus signal

772

self.PropertyChanged(dbus.String(u"checker_running"),

773

dbus.Boolean(False, variant_level=1))

774

1106

if os.WIFEXITED(condition):

775

1107

exitstatus = os.WEXITSTATUS(condition)

776

1108

# Emit D-Bus signal

786

1118

return Client.checker_callback(self, pid, condition, command,

787

1119

*args, **kwargs)

788

1120

789

def checked_ok(self, *args, **kwargs):

790

r = Client.checked_ok(self, *args, **kwargs)

791

# Emit D-Bus signal

792

self.PropertyChanged(

793

dbus.String(u"last_checked_ok"),

794

(self._datetime_to_dbus(self.last_checked_ok,

795

variant_level=1)))

796

return r

797

798

1121

def start_checker(self, *args, **kwargs):

799

1122

old_checker = self.checker

800

1123

if self.checker is not None:

807

1130

and old_checker_pid != self.checker.pid):

808

1131

# Emit D-Bus signal

809

1132

self.CheckerStarted(self.current_checker_command)

810

self.PropertyChanged(

811

dbus.String(u"checker_running"),

812

dbus.Boolean(True, variant_level=1))

813

1133

return r

814

1134

815

def stop_checker(self, *args, **kwargs):

816

old_checker = getattr(self, u"checker", None)

817

r = Client.stop_checker(self, *args, **kwargs)

818

if (old_checker is not None

819

and getattr(self, u"checker", None) is None):

820

self.PropertyChanged(dbus.String(u"checker_running"),

821

dbus.Boolean(False, variant_level=1))

822

return r

823

824

1135

def _reset_approved(self):

825

1136

self._approved = None

826

1137

return False

828

1139

def approve(self, value=True):

829

1140

self.send_changedstate()

830

1141

self._approved = value

831

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

1142

gobject.timeout_add(_timedelta_to_milliseconds

1143

(self.approval_duration),

832

1144

self._reset_approved)

833

1145

834

1146

835

1147

## D-Bus methods, signals & properties

836

_interface = u"se.bsnet.fukt.Mandos.Client"

1148

_interface = "se.recompile.Mandos.Client"

837

1149

838

1150

## Signals

839

1151

840

1152

# CheckerCompleted - signal

841

@dbus.service.signal(_interface, signature=u"nxs")

1153

@dbus.service.signal(_interface, signature="nxs")

842

1154

def CheckerCompleted(self, exitcode, waitstatus, command):

843

1155

"D-Bus signal"

844

1156

pass

845

1157

846

1158

# CheckerStarted - signal

847

@dbus.service.signal(_interface, signature=u"s")

1159

@dbus.service.signal(_interface, signature="s")

848

1160

def CheckerStarted(self, command):

849

1161

"D-Bus signal"

850

1162

pass

851

1163

852

1164

# PropertyChanged - signal

853

@dbus.service.signal(_interface, signature=u"sv")

1165

@dbus.service.signal(_interface, signature="sv")

854

1166

def PropertyChanged(self, property, value):

855

1167

"D-Bus signal"

856

1168

pass

865

1177

pass

866

1178

867

1179

# Rejected - signal

868

@dbus.service.signal(_interface, signature=u"s")

1180

@dbus.service.signal(_interface, signature="s")

869

1181

def Rejected(self, reason):

870

1182

"D-Bus signal"

871

1183

pass

872

1184

873

1185

# NeedApproval - signal

874

@dbus.service.signal(_interface, signature=u"db")

1186

@dbus.service.signal(_interface, signature="tb")

875

1187

def NeedApproval(self, timeout, default):

876

1188

"D-Bus signal"

1189

return self.need_approval()

1190

1191

# NeRwequest - signal

1192

@dbus.service.signal(_interface, signature="s")

1193

def NewRequest(self, ip):

1194

"""D-Bus signal

1195

Is sent after a client request a password.

1196

"""

877

1197

pass

878

1198

879

1199

## Methods

880

1200

881

1201

# Approve - method

882

@dbus.service.method(_interface, in_signature=u"b")

1202

@dbus.service.method(_interface, in_signature="b")

883

1203

def Approve(self, value):

884

1204

self.approve(value)

885

1205

886

1206

# CheckedOK - method

887

1207

@dbus.service.method(_interface)

888

1208

def CheckedOK(self):

889

return self.checked_ok()

1209

self.checked_ok()

890

1210

891

1211

# Enable - method

892

1212

@dbus.service.method(_interface)

913

1233

914

1234

## Properties

915

1235

916

# approved_pending - property

917

@dbus_service_property(_interface, signature=u"b", access=u"read")

918

def approved_pending_dbus_property(self):

1236

# ApprovalPending - property

1237

@dbus_service_property(_interface, signature="b", access="read")

1238

def ApprovalPending_dbus_property(self):

919

1239

return dbus.Boolean(bool(self.approvals_pending))

920

1240

921

# approved_by_default - property

922

@dbus_service_property(_interface, signature=u"b",

923

access=u"readwrite")

924

def approved_by_default_dbus_property(self):

925

return dbus.Boolean(self.approved_by_default)

926

927

# approved_delay - property

928

@dbus_service_property(_interface, signature=u"t",

929

access=u"readwrite")

930

def approved_delay_dbus_property(self):

931

return dbus.UInt64(self.approved_delay_milliseconds())

932

933

# approved_duration - property

934

@dbus_service_property(_interface, signature=u"t",

935

access=u"readwrite")

936

def approved_duration_dbus_property(self):

937

return dbus.UInt64(self._timedelta_to_milliseconds(

938

self.approved_duration))

939

940

# name - property

941

@dbus_service_property(_interface, signature=u"s", access=u"read")

942

def name_dbus_property(self):

1241

# ApprovedByDefault - property

1242

@dbus_service_property(_interface, signature="b",

1243

access="readwrite")

1244

def ApprovedByDefault_dbus_property(self, value=None):

1245

if value is None: # get

1246

return dbus.Boolean(self.approved_by_default)

1247

self.approved_by_default = bool(value)

1248

1249

# ApprovalDelay - property

1250

@dbus_service_property(_interface, signature="t",

1251

access="readwrite")

1252

def ApprovalDelay_dbus_property(self, value=None):

1253

if value is None: # get

1254

return dbus.UInt64(self.approval_delay_milliseconds())

1255

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1256

1257

# ApprovalDuration - property

1258

@dbus_service_property(_interface, signature="t",

1259

access="readwrite")

1260

def ApprovalDuration_dbus_property(self, value=None):

1261

if value is None: # get

1262

return dbus.UInt64(_timedelta_to_milliseconds(

1263

self.approval_duration))

1264

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1265

1266

# Name - property

1267

@dbus_service_property(_interface, signature="s", access="read")

1268

def Name_dbus_property(self):

943

1269

return dbus.String(self.name)

944

1270

945

# fingerprint - property

946

@dbus_service_property(_interface, signature=u"s", access=u"read")

947

def fingerprint_dbus_property(self):

1271

# Fingerprint - property

1272

@dbus_service_property(_interface, signature="s", access="read")

1273

def Fingerprint_dbus_property(self):

948

1274

return dbus.String(self.fingerprint)

949

1275

950

# host - property

951

@dbus_service_property(_interface, signature=u"s",

952

access=u"readwrite")

953

def host_dbus_property(self, value=None):

1276

# Host - property

1277

@dbus_service_property(_interface, signature="s",

1278

access="readwrite")

1279

def Host_dbus_property(self, value=None):

954

1280

if value is None: # get

955

1281

return dbus.String(self.host)

956

1282

self.host = value

957

# Emit D-Bus signal

958

self.PropertyChanged(dbus.String(u"host"),

959

dbus.String(value, variant_level=1))

960

961

# created - property

962

@dbus_service_property(_interface, signature=u"s", access=u"read")

963

def created_dbus_property(self):

964

return dbus.String(self._datetime_to_dbus(self.created))

965

966

# last_enabled - property

967

@dbus_service_property(_interface, signature=u"s", access=u"read")

968

def last_enabled_dbus_property(self):

969

if self.last_enabled is None:

970

return dbus.String(u"")

971

return dbus.String(self._datetime_to_dbus(self.last_enabled))

972

973

# enabled - property

974

@dbus_service_property(_interface, signature=u"b",

975

access=u"readwrite")

976

def enabled_dbus_property(self, value=None):

1283

1284

# Created - property

1285

@dbus_service_property(_interface, signature="s", access="read")

1286

def Created_dbus_property(self):

1287

return datetime_to_dbus(self.created)

1288

1289

# LastEnabled - property

1290

@dbus_service_property(_interface, signature="s", access="read")

1291

def LastEnabled_dbus_property(self):

1292

return datetime_to_dbus(self.last_enabled)

1293

1294

# Enabled - property

1295

@dbus_service_property(_interface, signature="b",

1296

access="readwrite")

1297

def Enabled_dbus_property(self, value=None):

977

1298

if value is None: # get

978

1299

return dbus.Boolean(self.enabled)

979

1300

if value:

981

1302

else:

982

1303

self.disable()

983

1304

984

# last_checked_ok - property

985

@dbus_service_property(_interface, signature=u"s",

986

access=u"readwrite")

987

def last_checked_ok_dbus_property(self, value=None):

1305

# LastCheckedOK - property

1306

@dbus_service_property(_interface, signature="s",

1307

access="readwrite")

1308

def LastCheckedOK_dbus_property(self, value=None):

988

1309

if value is not None:

989

1310

self.checked_ok()

990

1311

return

991

if self.last_checked_ok is None:

992

return dbus.String(u"")

993

return dbus.String(self._datetime_to_dbus(self

994

.last_checked_ok))

995

996

# timeout - property

997

@dbus_service_property(_interface, signature=u"t",

998

access=u"readwrite")

999

def timeout_dbus_property(self, value=None):

1312

return datetime_to_dbus(self.last_checked_ok)

1313

1314

# Expires - property

1315

@dbus_service_property(_interface, signature="s", access="read")

1316

def Expires_dbus_property(self):

1317

return datetime_to_dbus(self.expires)

1318

1319

# LastApprovalRequest - property

1320

@dbus_service_property(_interface, signature="s", access="read")

1321

def LastApprovalRequest_dbus_property(self):

1322

return datetime_to_dbus(self.last_approval_request)

1323

1324

# Timeout - property

1325

@dbus_service_property(_interface, signature="t",

1326

access="readwrite")

1327

def Timeout_dbus_property(self, value=None):

1000

1328

if value is None: # get

1001

1329

return dbus.UInt64(self.timeout_milliseconds())

1002

1330

self.timeout = datetime.timedelta(0, 0, 0, value)

1003

# Emit D-Bus signal

1004

self.PropertyChanged(dbus.String(u"timeout"),

1005

dbus.UInt64(value, variant_level=1))

1006

if getattr(self, u"disable_initiator_tag", None) is None:

1331

if getattr(self, "disable_initiator_tag", None) is None:

1007

1332

return

1008

1333

# Reschedule timeout

1009

1334

gobject.source_remove(self.disable_initiator_tag)

1010

1335

self.disable_initiator_tag = None

1011

time_to_die = (self.

1012

_timedelta_to_milliseconds((self

1013

.last_checked_ok

1014

+ self.timeout)

1015

- datetime.datetime

1016

.utcnow()))

1336

self.expires = None

1337

time_to_die = _timedelta_to_milliseconds((self

1338

.last_checked_ok

1339

+ self.timeout)

1340

- datetime.datetime

1341

.utcnow())

1017

1342

if time_to_die <= 0:

1018

1343

# The timeout has passed

1019

1344

self.disable()

1020

1345

else:

1346

self.expires = (datetime.datetime.utcnow()

1347

+ datetime.timedelta(milliseconds =

1348

time_to_die))

1021

1349

self.disable_initiator_tag = (gobject.timeout_add

1022

1350

(time_to_die, self.disable))

1023

1351

1024

# interval - property

1025

@dbus_service_property(_interface, signature=u"t",

1026

access=u"readwrite")

1027

def interval_dbus_property(self, value=None):

1352

# ExtendedTimeout - property

1353

@dbus_service_property(_interface, signature="t",

1354

access="readwrite")

1355

def ExtendedTimeout_dbus_property(self, value=None):

1356

if value is None: # get

1357

return dbus.UInt64(self.extended_timeout_milliseconds())

1358

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1359

1360

# Interval - property

1361

@dbus_service_property(_interface, signature="t",

1362

access="readwrite")

1363

def Interval_dbus_property(self, value=None):

1028

1364

if value is None: # get

1029

1365

return dbus.UInt64(self.interval_milliseconds())

1030

1366

self.interval = datetime.timedelta(0, 0, 0, value)

1031

# Emit D-Bus signal

1032

self.PropertyChanged(dbus.String(u"interval"),

1033

dbus.UInt64(value, variant_level=1))

1034

if getattr(self, u"checker_initiator_tag", None) is None:

1367

if getattr(self, "checker_initiator_tag", None) is None:

1035

1368

return

1036

# Reschedule checker run

1037

gobject.source_remove(self.checker_initiator_tag)

1038

self.checker_initiator_tag = (gobject.timeout_add

1039

(value, self.start_checker))

1040

self.start_checker() # Start one now, too

1041

1042

# checker - property

1043

@dbus_service_property(_interface, signature=u"s",

1044

access=u"readwrite")

1045

def checker_dbus_property(self, value=None):

1369

if self.enabled:

1370

# Reschedule checker run

1371

gobject.source_remove(self.checker_initiator_tag)

1372

self.checker_initiator_tag = (gobject.timeout_add

1373

(value, self.start_checker))

1374

self.start_checker() # Start one now, too

1375

1376

# Checker - property

1377

@dbus_service_property(_interface, signature="s",

1378

access="readwrite")

1379

def Checker_dbus_property(self, value=None):

1046

1380

if value is None: # get

1047

1381

return dbus.String(self.checker_command)

1048

1382

self.checker_command = value

1049

# Emit D-Bus signal

1050

self.PropertyChanged(dbus.String(u"checker"),

1051

dbus.String(self.checker_command,

1052

variant_level=1))

1053

1383

1054

# checker_running - property

1055

@dbus_service_property(_interface, signature=u"b",

1056

access=u"readwrite")

1057

def checker_running_dbus_property(self, value=None):

1384

# CheckerRunning - property

1385

@dbus_service_property(_interface, signature="b",

1386

access="readwrite")

1387

def CheckerRunning_dbus_property(self, value=None):

1058

1388

if value is None: # get

1059

1389

return dbus.Boolean(self.checker is not None)

1060

1390

if value:

1062

1392

else:

1063

1393

self.stop_checker()

1064

1394

1065

# object_path - property

1066

@dbus_service_property(_interface, signature=u"o", access=u"read")

1067

def object_path_dbus_property(self):

1395

# ObjectPath - property

1396

@dbus_service_property(_interface, signature="o", access="read")

1397

def ObjectPath_dbus_property(self):

1068

1398

return self.dbus_object_path # is already a dbus.ObjectPath

1069

1399

1070

# secret = property

1071

@dbus_service_property(_interface, signature=u"ay",

1072

access=u"write", byte_arrays=True)

1073

def secret_dbus_property(self, value):

1400

# Secret = property

1401

@dbus_service_property(_interface, signature="ay",

1402

access="write", byte_arrays=True)

1403

def Secret_dbus_property(self, value):

1074

1404

self.secret = str(value)

1075

1405

1076

1406

del _interface

1082

1412

self._pipe.send(('init', fpr, address))

1083

1413

if not self._pipe.recv():

1084

1414

raise KeyError()

1085

1415

1086

1416

def __getattribute__(self, name):

1087

1417

if(name == '_pipe'):

1088

1418

return super(ProxyClient, self).__getattribute__(name)

1095

1425

self._pipe.send(('funcall', name, args, kwargs))

1096

1426

return self._pipe.recv()[1]

1097

1427

return func

1098

1428

1099

1429

def __setattr__(self, name, value):

1100

1430

if(name == '_pipe'):

1101

1431

return super(ProxyClient, self).__setattr__(name, value)

1102

1432

self._pipe.send(('setattr', name, value))

1103

1433

1104

1434

1435

class ClientDBusTransitional(ClientDBus):

1436

__metaclass__ = AlternateDBusNamesMetaclass

1437

1438

1105

1439

class ClientHandler(socketserver.BaseRequestHandler, object):

1106

1440

"""A class to handle client connections.

1107

1441

1110

1444

1111

1445

def handle(self):

1112

1446

with contextlib.closing(self.server.child_pipe) as child_pipe:

1113

logger.info(u"TCP connection from: %s",

1447

logger.info("TCP connection from: %s",

1114

1448

unicode(self.client_address))

1115

logger.debug(u"Pipe FD: %d",

1449

logger.debug("Pipe FD: %d",

1116

1450

self.server.child_pipe.fileno())

1117

1451

1118

1452

session = (gnutls.connection

1119

1453

.ClientSession(self.request,

1120

1454

gnutls.connection

1121

1455

.X509Credentials()))

1122

1456

1123

1457

# Note: gnutls.connection.X509Credentials is really a

1124

1458

# generic GnuTLS certificate credentials object so long as

1125

1459

# no X.509 keys are added to it. Therefore, we can use it

1126

1460

# here despite using OpenPGP certificates.

1127

1128

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1129

# u"+AES-256-CBC", u"+SHA1",

1130

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1131

# u"+DHE-DSS"))

1461

1462

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1463

# "+AES-256-CBC", "+SHA1",

1464

# "+COMP-NULL", "+CTYPE-OPENPGP",

1465

# "+DHE-DSS"))

1132

1466

# Use a fallback default, since this MUST be set.

1133

1467

priority = self.server.gnutls_priority

1134

1468

if priority is None:

1135

priority = u"NORMAL"

1469

priority = "NORMAL"

1136

1470

(gnutls.library.functions

1137

1471

.gnutls_priority_set_direct(session._c_object,

1138

1472

priority, None))

1139

1473

1140

1474

# Start communication using the Mandos protocol

1141

1475

# Get protocol number

1142

1476

line = self.request.makefile().readline()

1143

logger.debug(u"Protocol version: %r", line)

1477

logger.debug("Protocol version: %r", line)

1144

1478

try:

1145

1479

if int(line.strip().split()[0]) > 1:

1146

1480

raise RuntimeError

1147

except (ValueError, IndexError, RuntimeError), error:

1148

logger.error(u"Unknown protocol version: %s", error)

1481

except (ValueError, IndexError, RuntimeError) as error:

1482

logger.error("Unknown protocol version: %s", error)

1149

1483

return

1150

1484

1151

1485

# Start GnuTLS connection

1152

1486

try:

1153

1487

session.handshake()

1154

except gnutls.errors.GNUTLSError, error:

1155

logger.warning(u"Handshake failed: %s", error)

1488

except gnutls.errors.GNUTLSError as error:

1489

logger.warning("Handshake failed: %s", error)

1156

1490

# Do not run session.bye() here: the session is not

1157

1491

# established. Just abandon the request.

1158

1492

return

1159

logger.debug(u"Handshake succeeded")

1160

1493

logger.debug("Handshake succeeded")

1494

1161

1495

approval_required = False

1162

1496

try:

1163

1497

try:

1164

1498

fpr = self.fingerprint(self.peer_certificate

1165

1499

(session))

1166

except (TypeError, gnutls.errors.GNUTLSError), error:

1167

logger.warning(u"Bad certificate: %s", error)

1500

except (TypeError,

1501

gnutls.errors.GNUTLSError) as error:

1502

logger.warning("Bad certificate: %s", error)

1168

1503

return

1169

logger.debug(u"Fingerprint: %s", fpr)

1170

1504

logger.debug("Fingerprint: %s", fpr)

1505

if self.server.use_dbus:

1506

# Emit D-Bus signal

1507

client.NewRequest(str(self.client_address))

1508

1171

1509

try:

1172

1510

client = ProxyClient(child_pipe, fpr,

1173

1511

self.client_address)

1174

1512

except KeyError:

1175

1513

return

1176

1514

1177

if client.approved_delay:

1178

delay = client.approved_delay

1515

if client.approval_delay:

1516

delay = client.approval_delay

1179

1517

client.approvals_pending += 1

1180

1518

approval_required = True

1181

1519

1182

1520

while True:

1183

1521

if not client.enabled:

1184

logger.warning(u"Client %s is disabled",

1522

logger.info("Client %s is disabled",

1185

1523

client.name)

1186

1524

if self.server.use_dbus:

1187

1525

# Emit D-Bus signal

1188

client.Rejected("Disabled")

1526

client.Rejected("Disabled")

1189

1527

return

1190

1528

1191

if client._approved or not client.approved_delay:

1529

if client._approved or not client.approval_delay:

1192

1530

#We are approved or approval is disabled

1193

1531

break

1194

1532

elif client._approved is None:

1195

logger.info(u"Client %s need approval",

1533

logger.info("Client %s needs approval",

1196

1534

client.name)

1197

1535

if self.server.use_dbus:

1198

1536

# Emit D-Bus signal

1199

1537

client.NeedApproval(

1200

client.approved_delay_milliseconds(),

1538

client.approval_delay_milliseconds(),

1201

1539

client.approved_by_default)

1202

1540

else:

1203

logger.warning(u"Client %s was not approved",

1541

logger.warning("Client %s was not approved",

1204

1542

client.name)

1205

1543

if self.server.use_dbus:

1206

1544

# Emit D-Bus signal

1207

client.Rejected("Disapproved")

1545

client.Rejected("Denied")

1208

1546

return

1209

1547

1210

1548

#wait until timeout or approved

1211

#x = float(client._timedelta_to_milliseconds(delay))

1212

1549

time = datetime.datetime.now()

1213

1550

client.changedstate.acquire()

1214

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1551

(client.changedstate.wait

1552

(float(client._timedelta_to_milliseconds(delay)

1553

/ 1000)))

1215

1554

client.changedstate.release()

1216

1555

time2 = datetime.datetime.now()

1217

1556

if (time2 - time) >= delay:

1221

1560

client.name)

1222

1561

if self.server.use_dbus:

1223

1562

# Emit D-Bus signal

1224

client.Rejected("Time out")

1563

client.Rejected("Approval timed out")

1225

1564

return

1226

1565

else:

1227

1566

break

1232

1571

while sent_size < len(client.secret):

1233

1572

try:

1234

1573

sent = session.send(client.secret[sent_size:])

1235

except (gnutls.errors.GNUTLSError), error:

1574

except gnutls.errors.GNUTLSError as error:

1236

1575

logger.warning("gnutls send failed")

1237

1576

return

1238

logger.debug(u"Sent: %d, remaining: %d",

1577

logger.debug("Sent: %d, remaining: %d",

1239

1578

sent, len(client.secret)

1240

1579

- (sent_size + sent))

1241

1580

sent_size += sent

1242

1243

logger.info(u"Sending secret to %s", client.name)

1244

# bump the timeout as if seen

1245

client.checked_ok()

1581

1582

logger.info("Sending secret to %s", client.name)

1583

# bump the timeout using extended_timeout

1584

client.checked_ok(client.extended_timeout)

1246

1585

if self.server.use_dbus:

1247

1586

# Emit D-Bus signal

1248

1587

client.GotSecret()

1252

1591

client.approvals_pending -= 1

1253

1592

try:

1254

1593

session.bye()

1255

except (gnutls.errors.GNUTLSError), error:

1256

logger.warning("gnutls bye failed")

1594

except gnutls.errors.GNUTLSError as error:

1595

logger.warning("GnuTLS bye failed")

1257

1596

1258

1597

@staticmethod

1259

1598

def peer_certificate(session):

1269

1608

.gnutls_certificate_get_peers

1270

1609

(session._c_object, ctypes.byref(list_size)))

1271

1610

if not bool(cert_list) and list_size.value != 0:

1272

raise gnutls.errors.GNUTLSError(u"error getting peer"

1273

u" certificate")

1611

raise gnutls.errors.GNUTLSError("error getting peer"

1612

" certificate")

1274

1613

if list_size.value == 0:

1275

1614

return None

1276

1615

cert = cert_list[0]

1302

1641

if crtverify.value != 0:

1303

1642

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1304

1643

raise (gnutls.errors.CertificateSecurityError

1305

(u"Verify failed"))

1644

("Verify failed"))

1306

1645

# New buffer for the fingerprint

1307

1646

buf = ctypes.create_string_buffer(20)

1308

1647

buf_len = ctypes.c_size_t()

1315

1654

# Convert the buffer to a Python bytestring

1316

1655

fpr = ctypes.string_at(buf, buf_len.value)

1317

1656

# Convert the bytestring to hexadecimal notation

1318

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1657

hex_fpr = binascii.hexlify(fpr).upper()

1319

1658

return hex_fpr

1320

1659

1321

1660

1327

1666

except:

1328

1667

self.handle_error(request, address)

1329

1668

self.close_request(request)

1330

1669

1331

1670

def process_request(self, request, address):

1332

1671

"""Start a new process to process the request."""

1333

multiprocessing.Process(target = self.sub_process_main,

1334

args = (request, address)).start()

1672

proc = multiprocessing.Process(target = self.sub_process_main,

1673

args = (request,

1674

address))

1675

proc.start()

1676

return proc

1677

1335

1678

1336

1679

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1337

1680

""" adds a pipe to the MixIn """

1341

1684

This function creates a new pipe in self.pipe

1342

1685

"""

1343

1686

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1344

1345

super(MultiprocessingMixInWithPipe,

1346

self).process_request(request, client_address)

1687

1688

proc = MultiprocessingMixIn.process_request(self, request,

1689

client_address)

1347

1690

self.child_pipe.close()

1348

self.add_pipe(parent_pipe)

1349

1350

def add_pipe(self, parent_pipe):

1691

self.add_pipe(parent_pipe, proc)

1692

1693

def add_pipe(self, parent_pipe, proc):

1351

1694

"""Dummy function; override as necessary"""

1352

pass

1695

raise NotImplementedError

1696

1353

1697

1354

1698

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1355

1699

socketserver.TCPServer, object):

1373

1717

bind to an address or port if they were not specified."""

1374

1718

if self.interface is not None:

1375

1719

if SO_BINDTODEVICE is None:

1376

logger.error(u"SO_BINDTODEVICE does not exist;"

1377

u" cannot bind to interface %s",

1720

logger.error("SO_BINDTODEVICE does not exist;"

1721

" cannot bind to interface %s",

1378

1722

self.interface)

1379

1723

else:

1380

1724

try:

1381

1725

self.socket.setsockopt(socket.SOL_SOCKET,

1382

1726

SO_BINDTODEVICE,

1383

1727

str(self.interface

1384

+ u'\0'))

1385

except socket.error, error:

1728

+ '\0'))

1729

except socket.error as error:

1386

1730

if error[0] == errno.EPERM:

1387

logger.error(u"No permission to"

1388

u" bind to interface %s",

1731

logger.error("No permission to"

1732

" bind to interface %s",

1389

1733

self.interface)

1390

1734

elif error[0] == errno.ENOPROTOOPT:

1391

logger.error(u"SO_BINDTODEVICE not available;"

1392

u" cannot bind to interface %s",

1735

logger.error("SO_BINDTODEVICE not available;"

1736

" cannot bind to interface %s",

1393

1737

self.interface)

1394

1738

else:

1395

1739

raise

1397

1741

if self.server_address[0] or self.server_address[1]:

1398

1742

if not self.server_address[0]:

1399

1743

if self.address_family == socket.AF_INET6:

1400

any_address = u"::" # in6addr_any

1744

any_address = "::" # in6addr_any

1401

1745

else:

1402

1746

any_address = socket.INADDR_ANY

1403

1747

self.server_address = (any_address,

1430

1774

self.enabled = False

1431

1775

self.clients = clients

1432

1776

if self.clients is None:

1433

self.clients = set()

1777

self.clients = {}

1434

1778

self.use_dbus = use_dbus

1435

1779

self.gnutls_priority = gnutls_priority

1436

1780

IPv6_TCPServer.__init__(self, server_address,

1440

1784

def server_activate(self):

1441

1785

if self.enabled:

1442

1786

return socketserver.TCPServer.server_activate(self)

1787

1443

1788

def enable(self):

1444

1789

self.enabled = True

1445

def add_pipe(self, parent_pipe):

1790

1791

def add_pipe(self, parent_pipe, proc):

1446

1792

# Call "handle_ipc" for both data and EOF events

1447

1793

gobject.io_add_watch(parent_pipe.fileno(),

1448

1794

gobject.IO_IN | gobject.IO_HUP,

1449

1795

functools.partial(self.handle_ipc,

1450

parent_pipe = parent_pipe))

1451

1796

parent_pipe =

1797

parent_pipe,

1798

proc = proc))

1799

1452

1800

def handle_ipc(self, source, condition, parent_pipe=None,

1453

client_object=None):

1801

proc = None, client_object=None):

1454

1802

condition_names = {

1455

gobject.IO_IN: u"IN", # There is data to read.

1456

gobject.IO_OUT: u"OUT", # Data can be written (without

1803

gobject.IO_IN: "IN", # There is data to read.

1804

gobject.IO_OUT: "OUT", # Data can be written (without

1457

1805

# blocking).

1458

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1459

gobject.IO_ERR: u"ERR", # Error condition.

1460

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1806

gobject.IO_PRI: "PRI", # There is urgent data to read.

1807

gobject.IO_ERR: "ERR", # Error condition.

1808

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1461

1809

# broken, usually for pipes and

1462

1810

# sockets).

1463

1811

}

1465

1813

for cond, name in

1466

1814

condition_names.iteritems()

1467

1815

if cond & condition)

1468

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1469

conditions_string)

1470

1471

# error or the other end of multiprocessing.Pipe has closed

1816

# error, or the other end of multiprocessing.Pipe has closed

1472

1817

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1818

# Wait for other process to exit

1819

proc.join()

1473

1820

return False

1474

1821

1475

1822

# Read a request from the child

1476

1823

request = parent_pipe.recv()

1477

logger.debug(u"IPC request: %s", repr(request))

1478

1824

command = request[0]

1479

1825

1480

1826

if command == 'init':

1481

1827

fpr = request[1]

1482

1828

address = request[2]

1483

1829

1484

for c in self.clients:

1830

for c in self.clients.itervalues():

1485

1831

if c.fingerprint == fpr:

1486

1832

client = c

1487

1833

break

1488

1834

else:

1489

logger.warning(u"Client not found for fingerprint: %s, ad"

1490

u"dress: %s", fpr, address)

1835

logger.info("Client not found for fingerprint: %s, ad"

1836

"dress: %s", fpr, address)

1491

1837

if self.use_dbus:

1492

1838

# Emit D-Bus signal

1493

mandos_dbus_service.ClientNotFound(fpr, address)

1839

mandos_dbus_service.ClientNotFound(fpr,

1840

address[0])

1494

1841

parent_pipe.send(False)

1495

1842

return False

1496

1843

1497

1844

gobject.io_add_watch(parent_pipe.fileno(),

1498

1845

gobject.IO_IN | gobject.IO_HUP,

1499

1846

functools.partial(self.handle_ipc,

1500

parent_pipe = parent_pipe,

1501

client_object = client))

1847

parent_pipe =

1848

parent_pipe,

1849

proc = proc,

1850

client_object =

1851

client))

1502

1852

parent_pipe.send(True)

1503

# remove the old hook in favor of the new above hook on same fileno

1853

# remove the old hook in favor of the new above hook on

1854

# same fileno

1504

1855

return False

1505

1856

if command == 'funcall':

1506

1857

funcname = request[1]

1507

1858

args = request[2]

1508

1859

kwargs = request[3]

1509

1860

1510

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1511

1861

parent_pipe.send(('data', getattr(client_object,

1862

funcname)(*args,

1863

**kwargs)))

1864

1512

1865

if command == 'getattr':

1513

1866

attrname = request[1]

1514

1867

if callable(client_object.__getattribute__(attrname)):

1515

1868

parent_pipe.send(('function',))

1516

1869

else:

1517

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1870

parent_pipe.send(('data', client_object

1871

.__getattribute__(attrname)))

1518

1872

1519

1873

if command == 'setattr':

1520

1874

attrname = request[1]

1521

1875

value = request[2]

1522

1876

setattr(client_object, attrname, value)

1523

1877

1524

1878

return True

1525

1879

1526

1880

1527

1881

def string_to_delta(interval):

1528

1882

"""Parse a string and return a datetime.timedelta

1529

1883

1530

>>> string_to_delta(u'7d')

1884

>>> string_to_delta('7d')

1531

1885

datetime.timedelta(7)

1532

>>> string_to_delta(u'60s')

1886

>>> string_to_delta('60s')

1533

1887

datetime.timedelta(0, 60)

1534

>>> string_to_delta(u'60m')

1888

>>> string_to_delta('60m')

1535

1889

datetime.timedelta(0, 3600)

1536

>>> string_to_delta(u'24h')

1890

>>> string_to_delta('24h')

1537

1891

datetime.timedelta(1)

1538

>>> string_to_delta(u'1w')

1892

>>> string_to_delta('1w')

1539

1893

datetime.timedelta(7)

1540

>>> string_to_delta(u'5m 30s')

1894

>>> string_to_delta('5m 30s')

1541

1895

datetime.timedelta(0, 330)

1542

1896

"""

1543

1897

timevalue = datetime.timedelta(0)

1545

1899

try:

1546

1900

suffix = unicode(s[-1])

1547

1901

value = int(s[:-1])

1548

if suffix == u"d":

1902

if suffix == "d":

1549

1903

delta = datetime.timedelta(value)

1550

elif suffix == u"s":

1904

elif suffix == "s":

1551

1905

delta = datetime.timedelta(0, value)

1552

elif suffix == u"m":

1906

elif suffix == "m":

1553

1907

delta = datetime.timedelta(0, 0, 0, 0, value)

1554

elif suffix == u"h":

1908

elif suffix == "h":

1555

1909

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1556

elif suffix == u"w":

1910

elif suffix == "w":

1557

1911

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1558

1912

else:

1559

raise ValueError(u"Unknown suffix %r" % suffix)

1560

except (ValueError, IndexError), e:

1561

raise ValueError(e.message)

1913

raise ValueError("Unknown suffix %r" % suffix)

1914

except (ValueError, IndexError) as e:

1915

raise ValueError(*(e.args))

1562

1916

timevalue += delta

1563

1917

return timevalue

1564

1918

1565

1919

1566

def if_nametoindex(interface):

1567

"""Call the C function if_nametoindex(), or equivalent

1568

1569

Note: This function cannot accept a unicode string."""

1570

global if_nametoindex

1571

try:

1572

if_nametoindex = (ctypes.cdll.LoadLibrary

1573

(ctypes.util.find_library(u"c"))

1574

.if_nametoindex)

1575

except (OSError, AttributeError):

1576

logger.warning(u"Doing if_nametoindex the hard way")

1577

def if_nametoindex(interface):

1578

"Get an interface index the hard way, i.e. using fcntl()"

1579

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1580

with contextlib.closing(socket.socket()) as s:

1581

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1582

struct.pack(str(u"16s16x"),

1583

interface))

1584

interface_index = struct.unpack(str(u"I"),

1585

ifreq[16:20])[0]

1586

return interface_index

1587

return if_nametoindex(interface)

1588

1589

1590

1920

def daemon(nochdir = False, noclose = False):

1591

1921

"""See daemon(3). Standard BSD Unix function.

1592

1922

1595

1925

sys.exit()

1596

1926

os.setsid()

1597

1927

if not nochdir:

1598

os.chdir(u"/")

1928

os.chdir("/")

1599

1929

if os.fork():

1600

1930

sys.exit()

1601

1931

if not noclose:

1603

1933

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1604

1934

if not stat.S_ISCHR(os.fstat(null).st_mode):

1605

1935

raise OSError(errno.ENODEV,

1606

u"%s not a character device"

1936

"%s not a character device"

1607

1937

% os.path.devnull)

1608

1938

os.dup2(null, sys.stdin.fileno())

1609

1939

os.dup2(null, sys.stdout.fileno())

1617

1947

##################################################################

1618

1948

# Parsing of options, both command line and config file

1619

1949

1620

parser = optparse.OptionParser(version = "%%prog %s" % version)

1621

parser.add_option("-i", u"--interface", type=u"string",

1622

metavar="IF", help=u"Bind to interface IF")

1623

parser.add_option("-a", u"--address", type=u"string",

1624

help=u"Address to listen for requests on")

1625

parser.add_option("-p", u"--port", type=u"int",

1626

help=u"Port number to receive requests on")

1627

parser.add_option("--check", action=u"store_true",

1628

help=u"Run self-test")

1629

parser.add_option("--debug", action=u"store_true",

1630

help=u"Debug mode; run in foreground and log to"

1631

u" terminal")

1632

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1633

help=u"Debug level for stdout output")

1634

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1635

u" priority string (see GnuTLS documentation)")

1636

parser.add_option("--servicename", type=u"string",

1637

metavar=u"NAME", help=u"Zeroconf service name")

1638

parser.add_option("--configdir", type=u"string",

1639

default=u"/etc/mandos", metavar=u"DIR",

1640

help=u"Directory to search for configuration"

1641

u" files")

1642

parser.add_option("--no-dbus", action=u"store_false",

1643

dest=u"use_dbus", help=u"Do not provide D-Bus"

1644

u" system bus interface")

1645

parser.add_option("--no-ipv6", action=u"store_false",

1646

dest=u"use_ipv6", help=u"Do not use IPv6")

1647

options = parser.parse_args()[0]

1950

parser = argparse.ArgumentParser()

1951

parser.add_argument("-v", "--version", action="version",

1952

version = "%%(prog)s %s" % version,

1953

help="show version number and exit")

1954

parser.add_argument("-i", "--interface", metavar="IF",

1955

help="Bind to interface IF")

1956

parser.add_argument("-a", "--address",

1957

help="Address to listen for requests on")

1958

parser.add_argument("-p", "--port", type=int,

1959

help="Port number to receive requests on")

1960

parser.add_argument("--check", action="store_true",

1961

help="Run self-test")

1962

parser.add_argument("--debug", action="store_true",

1963

help="Debug mode; run in foreground and log"

1964

" to terminal")

1965

parser.add_argument("--debuglevel", metavar="LEVEL",

1966

help="Debug level for stdout output")

1967

parser.add_argument("--priority", help="GnuTLS"

1968

" priority string (see GnuTLS documentation)")

1969

parser.add_argument("--servicename",

1970

metavar="NAME", help="Zeroconf service name")

1971

parser.add_argument("--configdir",

1972

default="/etc/mandos", metavar="DIR",

1973

help="Directory to search for configuration"

1974

" files")

1975

parser.add_argument("--no-dbus", action="store_false",

1976

dest="use_dbus", help="Do not provide D-Bus"

1977

" system bus interface")

1978

parser.add_argument("--no-ipv6", action="store_false",

1979

dest="use_ipv6", help="Do not use IPv6")

1980

parser.add_argument("--no-restore", action="store_false",

1981

dest="restore", help="Do not restore stored"

1982

" state")

1983

parser.add_argument("--statedir", metavar="DIR",

1984

help="Directory to save/restore state in")

1985

1986

options = parser.parse_args()

1648

1987

1649

1988

if options.check:

1650

1989

import doctest

1652

1991

sys.exit()

1653

1992

1654

1993

# Default values for config file for server-global settings

1655

server_defaults = { u"interface": u"",

1656

u"address": u"",

1657

u"port": u"",

1658

u"debug": u"False",

1659

u"priority":

1660

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1661

u"servicename": u"Mandos",

1662

u"use_dbus": u"True",

1663

u"use_ipv6": u"True",

1664

u"debuglevel": u"",

1994

server_defaults = { "interface": "",

1995

"address": "",

1996

"port": "",

1997

"debug": "False",

1998

"priority":

1999

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2000

"servicename": "Mandos",

2001

"use_dbus": "True",

2002

"use_ipv6": "True",

2003

"debuglevel": "",

2004

"restore": "True",

2005

"statedir": "/var/lib/mandos"

1665

2006

}

1666

2007

1667

2008

# Parse config file for server-global settings

1668

2009

server_config = configparser.SafeConfigParser(server_defaults)

1669

2010

del server_defaults

1670

2011

server_config.read(os.path.join(options.configdir,

1671

u"mandos.conf"))

2012

"mandos.conf"))

1672

2013

# Convert the SafeConfigParser object to a dict

1673

2014

server_settings = server_config.defaults()

1674

2015

# Use the appropriate methods on the non-string config options

1675

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1676

server_settings[option] = server_config.getboolean(u"DEFAULT",

2016

for option in ("debug", "use_dbus", "use_ipv6"):

2017

server_settings[option] = server_config.getboolean("DEFAULT",

1677

2018

option)

1678

2019

if server_settings["port"]:

1679

server_settings["port"] = server_config.getint(u"DEFAULT",

1680

u"port")

2020

server_settings["port"] = server_config.getint("DEFAULT",

2021

"port")

1681

2022

del server_config

1682

2023

1683

2024

# Override the settings from the config file with command line

1684

2025

# options, if set.

1685

for option in (u"interface", u"address", u"port", u"debug",

1686

u"priority", u"servicename", u"configdir",

1687

u"use_dbus", u"use_ipv6", u"debuglevel"):

2026

for option in ("interface", "address", "port", "debug",

2027

"priority", "servicename", "configdir",

2028

"use_dbus", "use_ipv6", "debuglevel", "restore",

2029

"statedir"):

1688

2030

value = getattr(options, option)

1689

2031

if value is not None:

1690

2032

server_settings[option] = value

1698

2040

##################################################################

1699

2041

1700

2042

# For convenience

1701

debug = server_settings[u"debug"]

1702

debuglevel = server_settings[u"debuglevel"]

1703

use_dbus = server_settings[u"use_dbus"]

1704

use_ipv6 = server_settings[u"use_ipv6"]

1705

1706

if server_settings[u"servicename"] != u"Mandos":

2043

debug = server_settings["debug"]

2044

debuglevel = server_settings["debuglevel"]

2045

use_dbus = server_settings["use_dbus"]

2046

use_ipv6 = server_settings["use_ipv6"]

2047

stored_state_path = os.path.join(server_settings["statedir"],

2048

stored_state_file)

2049

2050

if debug:

2051

initlogger(logging.DEBUG)

2052

else:

2053

if not debuglevel:

2054

initlogger()

2055

else:

2056

level = getattr(logging, debuglevel.upper())

2057

initlogger(level)

2058

2059

if server_settings["servicename"] != "Mandos":

1707

2060

syslogger.setFormatter(logging.Formatter

1708

(u'Mandos (%s) [%%(process)d]:'

1709

u' %%(levelname)s: %%(message)s'

1710

% server_settings[u"servicename"]))

2061

('Mandos (%s) [%%(process)d]:'

2062

' %%(levelname)s: %%(message)s'

2063

% server_settings["servicename"]))

1711

2064

1712

2065

# Parse config file with clients

1713

client_defaults = { u"timeout": u"1h",

1714

u"interval": u"5m",

1715

u"checker": u"fping -q -- %%(host)s",

1716

u"host": u"",

1717

u"approved_delay": u"0s",

1718

u"approved_duration": u"1s",

2066

client_defaults = { "timeout": "5m",

2067

"extended_timeout": "15m",

2068

"interval": "2m",

2069

"checker": "fping -q -- %%(host)s",

2070

"host": "",

2071

"approval_delay": "0s",

2072

"approval_duration": "1s",

1719

2073

}

1720

2074

client_config = configparser.SafeConfigParser(client_defaults)

1721

client_config.read(os.path.join(server_settings[u"configdir"],

1722

u"clients.conf"))

2075

client_config.read(os.path.join(server_settings["configdir"],

2076

"clients.conf"))

1723

2077

1724

2078

global mandos_dbus_service

1725

2079

mandos_dbus_service = None

1726

2080

1727

tcp_server = MandosServer((server_settings[u"address"],

1728

server_settings[u"port"]),

2081

tcp_server = MandosServer((server_settings["address"],

2082

server_settings["port"]),

1729

2083

ClientHandler,

1730

interface=server_settings[u"interface"],

2084

interface=(server_settings["interface"]

2085

or None),

1731

2086

use_ipv6=use_ipv6,

1732

2087

gnutls_priority=

1733

server_settings[u"priority"],

2088

server_settings["priority"],

1734

2089

use_dbus=use_dbus)

1735

pidfilename = u"/var/run/mandos.pid"

1736

try:

1737

pidfile = open(pidfilename, u"w")

1738

except IOError:

1739

logger.error(u"Could not open file %r", pidfilename)

2090

if not debug:

2091

pidfilename = "/var/run/mandos.pid"

2092

try:

2093

pidfile = open(pidfilename, "w")

2094

except IOError:

2095

logger.error("Could not open file %r", pidfilename)

1740

2096

1741

2097

try:

1742

uid = pwd.getpwnam(u"_mandos").pw_uid

1743

gid = pwd.getpwnam(u"_mandos").pw_gid

2098

uid = pwd.getpwnam("_mandos").pw_uid

2099

gid = pwd.getpwnam("_mandos").pw_gid

1744

2100

except KeyError:

1745

2101

try:

1746

uid = pwd.getpwnam(u"mandos").pw_uid

1747

gid = pwd.getpwnam(u"mandos").pw_gid

2102

uid = pwd.getpwnam("mandos").pw_uid

2103

gid = pwd.getpwnam("mandos").pw_gid

1748

2104

except KeyError:

1749

2105

try:

1750

uid = pwd.getpwnam(u"nobody").pw_uid

1751

gid = pwd.getpwnam(u"nobody").pw_gid

2106

uid = pwd.getpwnam("nobody").pw_uid

2107

gid = pwd.getpwnam("nobody").pw_gid

1752

2108

except KeyError:

1753

2109

uid = 65534

1754

2110

gid = 65534

1755

2111

try:

1756

2112

os.setgid(gid)

1757

2113

os.setuid(uid)

1758

except OSError, error:

2114

except OSError as error:

1759

2115

if error[0] != errno.EPERM:

1760

2116

raise error

1761

2117

1762

# Enable all possible GnuTLS debugging

1763

1764

1765

if not debug and not debuglevel:

1766

syslogger.setLevel(logging.WARNING)

1767

console.setLevel(logging.WARNING)

1768

if debuglevel:

1769

level = getattr(logging, debuglevel.upper())

1770

syslogger.setLevel(level)

1771

console.setLevel(level)

1772

1773

2118

if debug:

2119

# Enable all possible GnuTLS debugging

2120

1774

2121

# "Use a log level over 10 to enable all debugging options."

1775

2122

# - GnuTLS manual

1776

2123

gnutls.library.functions.gnutls_global_set_log_level(11)

1777

2124

1778

2125

@gnutls.library.types.gnutls_log_func

1779

2126

def debug_gnutls(level, string):

1780

logger.debug(u"GnuTLS: %s", string[:-1])

2127

logger.debug("GnuTLS: %s", string[:-1])

1781

2128

1782

2129

(gnutls.library.functions

1783

2130

.gnutls_global_set_log_function(debug_gnutls))

1784

2131

1785

2132

# Redirect stdin so all checkers get /dev/null

1786

2133

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1787

2134

os.dup2(null, sys.stdin.fileno())

1790

2137

else:

1791

2138

# No console logging

1792

2139

logger.removeHandler(console)

1793

2140

2141

# Need to fork before connecting to D-Bus

2142

if not debug:

2143

# Close all input and output, do double fork, etc.

2144

daemon()

1794

2145

1795

2146

global main_loop

1796

2147

# From the Avahi example code

1800

2151

# End of Avahi example code

1801

2152

if use_dbus:

1802

2153

try:

1803

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2154

bus_name = dbus.service.BusName("se.recompile.Mandos",

1804

2155

bus, do_not_queue=True)

1805

except dbus.exceptions.NameExistsException, e:

1806

logger.error(unicode(e) + u", disabling D-Bus")

2156

old_bus_name = (dbus.service.BusName

2157

("se.bsnet.fukt.Mandos", bus,

2158

do_not_queue=True))

2159

except dbus.exceptions.NameExistsException as e:

2160

logger.error(unicode(e) + ", disabling D-Bus")

1807

2161

use_dbus = False

1808

server_settings[u"use_dbus"] = False

2162

server_settings["use_dbus"] = False

1809

2163

tcp_server.use_dbus = False

1810

2164

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1811

service = AvahiService(name = server_settings[u"servicename"],

1812

servicetype = u"_mandos._tcp",

1813

protocol = protocol, bus = bus)

2165

service = AvahiServiceToSyslog(name =

2166

server_settings["servicename"],

2167

servicetype = "_mandos._tcp",

2168

protocol = protocol, bus = bus)

1814

2169

if server_settings["interface"]:

1815

2170

service.interface = (if_nametoindex

1816

(str(server_settings[u"interface"])))

1817

1818

if not debug:

1819

# Close all input and output, do double fork, etc.

1820

daemon()

1821

2171

(str(server_settings["interface"])))

2172

1822

2173

global multiprocessing_manager

1823

2174

multiprocessing_manager = multiprocessing.Manager()

1824

2175

1825

2176

client_class = Client

1826

2177

if use_dbus:

1827

client_class = functools.partial(ClientDBus, bus = bus)

1828

def client_config_items(config, section):

1829

special_settings = {

1830

"approved_by_default":

1831

lambda: config.getboolean(section,

1832

"approved_by_default"),

1833

}

1834

for name, value in config.items(section):

2178

client_class = functools.partial(ClientDBusTransitional,

2179

bus = bus)

2180

2181

special_settings = {

2182

# Some settings need to be accessd by special methods;

2183

# booleans need .getboolean(), etc. Here is a list of them:

2184

"approved_by_default":

2185

lambda section:

2186

client_config.getboolean(section, "approved_by_default"),

2187

"enabled":

2188

lambda section:

2189

client_config.getboolean(section, "enabled"),

2190

}

2191

# Construct a new dict of client settings of this form:

2192

# { client_name: {setting_name: value, ...}, ...}

2193

# with exceptions for any special settings as defined above

2194

client_settings = dict((clientname,

2195

dict((setting,

2196

(value

2197

if setting not in special_settings

2198

else special_settings[setting]

2199

(clientname)))

2200

for setting, value in

2201

client_config.items(clientname)))

2202

for clientname in client_config.sections())

2203

2204

old_client_settings = {}

2205

clients_data = []

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

2220

with Crypto() as crypt:

2221

for client in clients_data:

2222

client_name = client["name"]

2223

2224

# Decide which value to use after restoring saved state.

2225

# We have three different values: Old config file,

2226

# new config file, and saved state.

2227

# New config value takes precedence if it differs from old

2228

# config value, otherwise use saved state.

2229

for name, value in client_settings[client_name].items():

2230

try:

2231

# For each value in new config, check if it

2232

# differs from the old config value (Except for

2233

# the "secret" attribute)

2234

if (name != "secret" and

2235

value != old_client_settings[client_name]

2236

[name]):

2237

setattr(client, name, value)

2238

except KeyError:

2239

pass

2240

2241

# Clients who has passed its expire date can still be

2242

# enabled if its last checker was sucessful. Clients

2243

# whose checker failed before we stored its state is

2244

# assumed to have failed all checkers during downtime.

2245

if client["enabled"] and client["last_checked_ok"]:

2246

if ((datetime.datetime.utcnow()

2247

- client["last_checked_ok"])

2248

> client["interval"]):

2249

if client["last_checker_status"] != 0:

2250

client["enabled"] = False

2251

else:

2252

client["expires"] = (datetime.datetime

2253

.utcnow()

2254

+ client["timeout"])

2255

2256

client["changedstate"] = (multiprocessing_manager

2257

.Condition

2258

(multiprocessing_manager

2259

.Lock()))

2260

if use_dbus:

2261

new_client = (ClientDBusTransitional.__new__

2262

(ClientDBusTransitional))

2263

tcp_server.clients[client_name] = new_client

2264

new_client.bus = bus

2265

for name, value in client.iteritems():

2266

setattr(new_client, name, value)

2267

client_object_name = unicode(client_name).translate(

2268

{ord("."): ord("_"),

2269

ord("-"): ord("_")})

2270

new_client.dbus_object_path = (dbus.ObjectPath

2271

("/clients/"

2272

+ client_object_name))

2273

DBusObjectWithProperties.__init__(new_client,

2274

new_client.bus,

2275

new_client

2276

.dbus_object_path)

2277

else:

2278

tcp_server.clients[client_name] = (Client.__new__

2279

(Client))

2280

for name, value in client.iteritems():

2281

setattr(tcp_server.clients[client_name],

2282

name, value)

2283

1835

2284

try:

1836

yield (name, special_settings[name]())

1837

except KeyError:

1838

yield (name, value)

1839

1840

tcp_server.clients.update(set(

1841

client_class(name = section,

1842

config= dict(client_config_items(

1843

client_config, section)))

1844

for section in client_config.sections()))

2285

tcp_server.clients[client_name].secret = (

2286

crypt.decrypt(tcp_server.clients[client_name]

2287

.encrypted_secret,

2288

client_settings[client_name]

2289

["secret"]))

2290

except CryptoError:

2291

# If decryption fails, we use secret from new settings

2292

tcp_server.clients[client_name].secret = (

2293

client_settings[client_name]["secret"])

2294

2295

# Create/remove clients based on new changes made to config

2296

for clientname in set(old_client_settings) - set(client_settings):

2297

del tcp_server.clients[clientname]

2298

for clientname in set(client_settings) - set(old_client_settings):

2299

tcp_server.clients[clientname] = (client_class(name

2300

= clientname,

2301

config =

2302

client_settings

2303

[clientname]))

2304

1845

2305

if not tcp_server.clients:

1846

logger.warning(u"No clients defined")

2306

logger.warning("No clients defined")

1847

2307

1848

try:

1849

with pidfile:

1850

pid = os.getpid()

1851

pidfile.write(str(pid) + "\n")

1852

del pidfile

1853

except IOError:

1854

logger.error(u"Could not write to file %r with PID %d",

1855

pidfilename, pid)

1856

except NameError:

1857

# "pidfile" was never created

1858

pass

1859

del pidfilename

1860

1861

2308

if not debug:

2309

try:

2310

with pidfile:

2311

pid = os.getpid()

2312

pidfile.write(str(pid) + "\n".encode("utf-8"))

2313

del pidfile

2314

except IOError:

2315

logger.error("Could not write to file %r with PID %d",

2316

pidfilename, pid)

2317

except NameError:

2318

# "pidfile" was never created

2319

pass

2320

del pidfilename

2321

1862

2322

signal.signal(signal.SIGINT, signal.SIG_IGN)

2323

1863

2324

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1864

2325

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1865

2326

1867

2328

class MandosDBusService(dbus.service.Object):

1868

2329

"""A D-Bus proxy object"""

1869

2330

def __init__(self):

1870

dbus.service.Object.__init__(self, bus, u"/")

1871

_interface = u"se.bsnet.fukt.Mandos"

2331

dbus.service.Object.__init__(self, bus, "/")

2332

_interface = "se.recompile.Mandos"

1872

2333

1873

@dbus.service.signal(_interface, signature=u"o")

2334

@dbus.service.signal(_interface, signature="o")

1874

2335

def ClientAdded(self, objpath):

1875

2336

"D-Bus signal"

1876

2337

pass

1877

2338

1878

@dbus.service.signal(_interface, signature=u"ss")

2339

@dbus.service.signal(_interface, signature="ss")

1879

2340

def ClientNotFound(self, fingerprint, address):

1880

2341

"D-Bus signal"

1881

2342

pass

1882

2343

1883

@dbus.service.signal(_interface, signature=u"os")

2344

@dbus.service.signal(_interface, signature="os")

1884

2345

def ClientRemoved(self, objpath, name):

1885

2346

"D-Bus signal"

1886

2347

pass

1887

2348

1888

@dbus.service.method(_interface, out_signature=u"ao")

2349

@dbus.service.method(_interface, out_signature="ao")

1889

2350

def GetAllClients(self):

1890

2351

"D-Bus method"

1891

2352

return dbus.Array(c.dbus_object_path

1892

for c in tcp_server.clients)

2353

for c in

2354

tcp_server.clients.itervalues())

1893

2355

1894

2356

@dbus.service.method(_interface,

1895

out_signature=u"a{oa{sv}}")

2357

out_signature="a{oa{sv}}")

1896

2358

def GetAllClientsWithProperties(self):

1897

2359

"D-Bus method"

1898

2360

return dbus.Dictionary(

1899

((c.dbus_object_path, c.GetAll(u""))

1900

for c in tcp_server.clients),

1901

signature=u"oa{sv}")

2361

((c.dbus_object_path, c.GetAll(""))

2362

for c in tcp_server.clients.itervalues()),

2363

signature="oa{sv}")

1902

2364

1903

@dbus.service.method(_interface, in_signature=u"o")

2365

@dbus.service.method(_interface, in_signature="o")

1904

2366

def RemoveClient(self, object_path):

1905

2367

"D-Bus method"

1906

for c in tcp_server.clients:

2368

for c in tcp_server.clients.itervalues():

1907

2369

if c.dbus_object_path == object_path:

1908

tcp_server.clients.remove(c)

2370

del tcp_server.clients[c.name]

1909

2371

c.remove_from_connection()

1910

2372

# Don't signal anything except ClientRemoved

1911

2373

c.disable(quiet=True)

1916

2378

1917

2379

del _interface

1918

2380

1919

mandos_dbus_service = MandosDBusService()

2381

class MandosDBusServiceTransitional(MandosDBusService):

2382

__metaclass__ = AlternateDBusNamesMetaclass

2383

mandos_dbus_service = MandosDBusServiceTransitional()

1920

2384

1921

2385

def cleanup():

1922

2386

"Cleanup function; run on exit"

1923

2387

service.cleanup()

1924

2388

2389

multiprocessing.active_children()

2390

if not (tcp_server.clients or client_settings):

2391

return

2392

2393

# Store client before exiting. Secrets are encrypted with key

2394

# based on what config file has. If config file is

2395

# removed/edited, old secret will thus be unrecovable.

2396

clients = []

2397

with Crypto() as crypt:

2398

for client in tcp_server.clients.itervalues():

2399

key = client_settings[client.name]["secret"]

2400

client.encrypted_secret = crypt.encrypt(client.secret,

2401

key)

2402

client_dict = {}

2403

2404

# A list of attributes that will not be stored when

2405

# shutting down.

2406

exclude = set(("bus", "changedstate", "secret"))

2407

for name, typ in (inspect.getmembers

2408

(dbus.service.Object)):

2409

exclude.add(name)

2410

2411

client_dict["encrypted_secret"] = (client

2412

.encrypted_secret)

2413

for attr in client.client_structure:

2414

if attr not in exclude:

2415

client_dict[attr] = getattr(client, attr)

2416

2417

clients.append(client_dict)

2418

del client_settings[client.name]["secret"]

2419

2420

try:

2421

with os.fdopen(os.open(stored_state_path,

2422

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2423

0600), "wb") as stored_state:

2424

pickle.dump((clients, client_settings), stored_state)

2425

except (IOError, OSError) as e:

2426

logger.warning("Could not save persistent state: {0}"

2427

.format(e))

2428

if e.errno not in (errno.ENOENT, errno.EACCES):

2429

raise

2430

2431

# Delete all clients, and settings from config

1925

2432

while tcp_server.clients:

1926

client = tcp_server.clients.pop()

2433

name, client = tcp_server.clients.popitem()

1927

2434

if use_dbus:

1928

2435

client.remove_from_connection()

1929

client.disable_hook = None

1930

2436

# Don't signal anything except ClientRemoved

1931

2437

client.disable(quiet=True)

1932

2438

if use_dbus:

1933

2439

# Emit D-Bus signal

1934

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2440

mandos_dbus_service.ClientRemoved(client

2441

.dbus_object_path,

1935

2442

client.name)

2443

client_settings.clear()

1936

2444

1937

2445

atexit.register(cleanup)

1938

2446

1939

for client in tcp_server.clients:

2447

for client in tcp_server.clients.itervalues():

1940

2448

if use_dbus:

1941

2449

# Emit D-Bus signal

1942

2450

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1943

client.enable()

2451

# Need to initiate checking of clients

2452

if client.enabled:

2453

client.init_checker()

1944

2454

1945

2455

tcp_server.enable()

1946

2456

tcp_server.server_activate()

1948

2458

# Find out what port we got

1949

2459

service.port = tcp_server.socket.getsockname()[1]

1950

2460

if use_ipv6:

1951

logger.info(u"Now listening on address %r, port %d,"

2461

logger.info("Now listening on address %r, port %d,"

1952

2462

" flowinfo %d, scope_id %d"

1953

2463

% tcp_server.socket.getsockname())

1954

2464

else: # IPv4

1955

logger.info(u"Now listening on address %r, port %d"

2465

logger.info("Now listening on address %r, port %d"

1956

2466

% tcp_server.socket.getsockname())

1957

2467

1958

2468

#service.interface = tcp_server.socket.getsockname()[3]

1961

2471

# From the Avahi example code

1962

2472

try:

1963

2473

service.activate()

1964

except dbus.exceptions.DBusException, error:

1965

logger.critical(u"DBusException: %s", error)

2474

except dbus.exceptions.DBusException as error:

2475

logger.critical("DBusException: %s", error)

1966

2476

cleanup()

1967

2477

sys.exit(1)

1968

2478

# End of Avahi example code

1972

2482

(tcp_server.handle_request

1973

2483

(*args[2:], **kwargs) or True))

1974

2484

1975

logger.debug(u"Starting main loop")

2485

logger.debug("Starting main loop")

1976

2486

main_loop.run()

1977

except AvahiError, error:

1978

logger.critical(u"AvahiError: %s", error)

2487

except AvahiError as error:

2488

logger.critical("AvahiError: %s", error)

1979

2489

cleanup()

1980

2490

sys.exit(1)

1981

2491

except KeyboardInterrupt:

1982

2492

if debug:

1983

print >> sys.stderr

1984

logger.debug(u"Server received KeyboardInterrupt")

1985

logger.debug(u"Server exiting")

2493

print("", file=sys.stderr)

2494

logger.debug("Server received KeyboardInterrupt")

2495

logger.debug("Server exiting")

1986

2496

# Must run before the D-Bus bus name gets deregistered

1987

2497

cleanup()

1988

2498

2499

1989

2500

if __name__ == '__main__':

1990

2501

main()